Travis Herbranson 7eb8d756d1 compile: first compile — 17 entities, 2 synthesis, all indexes rebuilt

Read all 62 source files (Dev: 37, Homelab: 22, Venture: 3, Reference: 0).

Entity pages created (17):
- Wiki/Reference: lovebug, jenny, sunnie, n8n, ob1, tailscale, authentik,
  traefik, cloudflare, obsidian, gitea, plant-based-southerner, claude-code,
  dispatch, docker
- Wiki/Homelab: proxmox
- Wiki/Dev: pbs-hub, herbydev

Synthesis pages created (2):
- Wiki/Homelab/homelab-ingress-stack — four-layer ingress model (Cloudflare +
  Traefik + Authentik + Tailscale); operational lessons from 10+ source files
- Wiki/Dev/ai-memory-architecture — three memory layers (wiki + OB1 + Dispatch
  context); ingest paths; harness-vs-model design decision

All 11 index pages rebuilt (Sources/Dev, Venture, Homelab, Reference, Sources
root; Wiki/Dev, Venture, Homelab, Reference, Wiki root; vault root index.md).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-08 18:15:31 -04:00

2.5 KiB

Raw Blame History

type

path

Traefik

What it is

Traefik is the reverse proxy and ingress router for PBS infrastructure. It handles TLS termination, service routing, middleware chains, and integration with Cloudflare for DNS and tunnel-based access. Traefik runs as a Docker container in the PBS Linode stack and is the entry point for all HTTP/HTTPS traffic to PBS services.

Current state

Active at version 3.6.11 (upgraded March 2026 during the server stability hardening session). Key configurations:

TLS — wildcard certificates via Let's Encrypt + Cloudflare DNS challenge
Routing — all PBS services (WordPress, n8n, pbs-hub, Gitea, MySQL proxy, etc.) routed through Traefik labels
Middleware — block-wpcron middleware prevents direct HTTP access to wp-cron.php (replaced by Supercronic sidecar)
Cloudflare Tunnel — Traefik sits behind Cloudflare Tunnel for MCP and some homelab services
Knot DNS — primary and secondary DNS integrated with Traefik TLS pipeline

The homelab also runs Traefik (or uses the same pattern) for .herbylab.dev services behind Authentik.

Where it lives

PBS Linode Docker stack (traefik service in Docker Compose)
Config: labels on Docker Compose services + traefik.yml / dynamic/ config files
Homelab: separate Traefik instance (or shared) for .herbylab.dev

Sources/Homelab/traefik-deployment — full Traefik deployment plan
Sources/Homelab/server-stability-and-security-hardening — v3.6.11 upgrade
Sources/Homelab/wp-cron-supercronic-deploy — block-wpcron middleware
Sources/Homelab/ufw-docker-outage-fix — UFW + Docker/Traefik outbound rules fix
Sources/Homelab/homelab-mcp-server — MCP server behind Traefik
Wiki/Reference/cloudflare — tunnel + DNS
Wiki/Reference/authentik — auth layer
Wiki/Homelab/homelab-ingress-stack — synthesis

History

Ongoing — Core PBS ingress layer
March 2026 — Upgraded to v3.6.11 during server stability work
March 2026 — block-wpcron middleware added when Supercronic replaced WP-Cron
2026 — UFW after.rules fixed to restore Docker/Traefik outbound routing after UFW misconfiguration caused outage
2026-05-06 — Traefik used as ingress for MCP server at mcp.herbylab.dev

2.5 KiB Raw Blame History